Today, we’ll discuss a relatively new vulnerability in Active Directory Certificate Services: the flawed part is an AD CS enrollment fallback during directory-object resolution. When this mechanism is used, the Certification Authority contacts the specified domain controller (attribute cdc) to obtain information about the object associated with the request (attribute rmd).
The Certighost vulnerability (CVE-2026-54121) is based on the fact that the CA does not verify whether the cdc actually points to a legitimate domain controller. Therefore, an attacker can specify an attacker-controlled host with fake LDAP/LSA services to respond to the request. As a result, a user with minimal privileges can gain control over the domain.
For more information about the vulnerability, you can read the original research and the description of the MS-WCCE protocol.
How to detect it
After successfully running the PoC, in addition to the obvious hunts for the created computer account name and artifacts inherited from Certipy and Impacket, there is an immediate desire to search for a characteristic set of request attributes: SAN with a DNS name, cdc, and rmd.
However, building detection solely on the simultaneous presence of all three attributes is not safe. The DNS name in the CSR can be passed in several ways:
as an additional attribute
SAN:dns=..., passed in thepwszAttributesstructure,in the X.509 extension
Subject Alternative Name.
As a rule, the value from pwszAttributes is considered more prioritized.
If we study the code of the proposed PoC, we will find that the SAN is passed both in a special extension and in attributes. We can remove it from pwszAttributes and successfully repeat the attack. In this case, our theoretical hunt for the list of attributes will not work.
Here is an example of event 4887, a successfully issued certificate that would not fall under the planned hunt:
It is more correct to focus on the cdc parameter. If it contains an IP address or not the name of one of the known domain controllers, then most likely this request is related to the exploitation of the vulnerability.
The dedicated CA server usually has a small and well-inventoried set of legitimate outgoing network connections. Therefore, a connection from the CA to an unknown or unauthorized host is an anomaly.
One of the most universal ways to detect this attack is to monitor the outgoing connections of the certsrv.exe process (or the entire CA server, if process telemetry is not available) to addresses that do not belong to a pre-defined list of allowed nodes.
To detect Certighost, it is recommended to monitor outgoing connections to TCP ports 445 and 389. Through SMB on port 445, the CA contacts the remote LSA service, and through LDAP on port 389, it receives information about the directory object. Port 636 can also be included in the rule for more general LDAP(S) control. In a properly segmented network, such a connection should not be established: outgoing SMB and LDAP traffic from the CA should only be allowed to known domain controllers and other necessary systems.
If outgoing network connections are not restricted, then one can use this vulnerability as a coerce. By specifying a controlled host in the cdc attribute, an attacker can force the CA to initiate an SMB connection and authenticate as the CA server computer account.
Protection
To eliminate the vulnerability, it is first necessary to install the corresponding security update on all ADCS servers.
As an additional protection measure, it is recommended to restrict outgoing network traffic from ADCS servers, allowing only connections necessary for their operation. In particular, SMB and LDAP requests should only be allowed to known domain controllers and other pre-defined hosts.
If it is not possible to install the update immediately, you can temporarily disable the fallback mechanism by removing the EDITF_ENABLECHASECLIENTDC flag from the EditFlags parameter.
However, it is essential to understand that this is only a temporary measure and not a replacement for the update. Besides, after disabling the mechanism, legitimate certificate registration scenarios that depend on cdc will stop working.